Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
4Static
static
3Microsoft-...IO.cmd
windows7-x64
4Microsoft-...IO.cmd
windows10-2004-x64
4Microsoft-...on.cmd
windows7-x64
4Microsoft-...on.cmd
windows10-2004-x64
4Microsoft-...on.cmd
windows7-x64
4Microsoft-...on.cmd
windows10-2004-x64
4Microsoft-...o.html
windows7-x64
1Microsoft-...o.html
windows10-2004-x64
1Microsoft-...32.dll
windows7-x64
1Microsoft-...32.dll
windows10-2004-x64
1Microsoft-...64.dll
windows7-x64
1Microsoft-...64.dll
windows10-2004-x64
1Microsoft-...on.cmd
windows7-x64
4Microsoft-...on.cmd
windows10-2004-x64
4Microsoft-...on.cmd
windows7-x64
4Microsoft-...on.cmd
windows10-2004-x64
4Microsoft-...on.cmd
windows7-x64
4Microsoft-...on.cmd
windows10-2004-x64
4Microsoft-...bs.cmd
windows7-x64
1Microsoft-...bs.cmd
windows10-2004-x64
1Microsoft-...mi.cmd
windows7-x64
4Microsoft-...mi.cmd
windows10-2004-x64
4Microsoft-...er.cmd
windows7-x64
4Microsoft-...er.cmd
windows10-2004-x64
4Microsoft-...ot.cmd
windows7-x64
4Microsoft-...ot.cmd
windows10-2004-x64
4Microsoft-...e.html
windows7-x64
1Microsoft-...e.html
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
03/10/2023, 14:21
Static task
static1
Behavioral task
behavioral1
Sample
Microsoft-Activation-Scripts-master/MAS/All-In-One-Version/MAS_AIO.cmd
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Microsoft-Activation-Scripts-master/MAS/All-In-One-Version/MAS_AIO.cmd
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/HWID_Activation.cmd
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/HWID_Activation.cmd
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/KMS38_Activation.cmd
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/KMS38_Activation.cmd
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/Ohook_Activation/BIN/Info.html
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/Ohook_Activation/BIN/Info.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral9
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/Ohook_Activation/BIN/sppc32.dll
Resource
win7-20230831-en
Behavioral task
behavioral10
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/Ohook_Activation/BIN/sppc32.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral11
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/Ohook_Activation/BIN/sppc64.dll
Resource
win7-20230831-en
Behavioral task
behavioral12
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/Ohook_Activation/BIN/sppc64.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral13
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/Ohook_Activation/Ohook_Activation.cmd
Resource
win7-20230831-en
Behavioral task
behavioral14
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/Ohook_Activation/Ohook_Activation.cmd
Resource
win10v2004-20230915-en
Behavioral task
behavioral15
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd
Resource
win7-20230831-en
Behavioral task
behavioral16
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd
Resource
win10v2004-20230915-en
Behavioral task
behavioral17
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Change_Edition.cmd
Resource
win7-20230831-en
Behavioral task
behavioral18
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Change_Edition.cmd
Resource
win10v2004-20230915-en
Behavioral task
behavioral19
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Check-Activation-Status-vbs.cmd
Resource
win7-20230831-en
Behavioral task
behavioral20
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Check-Activation-Status-vbs.cmd
Resource
win10v2004-20230915-en
Behavioral task
behavioral21
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Check-Activation-Status-wmi.cmd
Resource
win7-20230831-en
Behavioral task
behavioral22
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Check-Activation-Status-wmi.cmd
Resource
win10v2004-20230915-en
Behavioral task
behavioral23
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Extract_OEM_Folder.cmd
Resource
win7-20230831-en
Behavioral task
behavioral24
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Extract_OEM_Folder.cmd
Resource
win10v2004-20230915-en
Behavioral task
behavioral25
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Troubleshoot.cmd
Resource
win7-20230831-en
Behavioral task
behavioral26
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Troubleshoot.cmd
Resource
win10v2004-20230915-en
Behavioral task
behavioral27
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/_ReadMe.html
Resource
win7-20230831-en
Behavioral task
behavioral28
Sample
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/_ReadMe.html
Resource
win10v2004-20230915-en
General
-
Target
Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/HWID_Activation.cmd
-
Size
54KB
-
MD5
7ddb1766a6574fd10e29303e24272ad1
-
SHA1
c91185a98353e64ebd4707e26fbbffa5d4d7e7c3
-
SHA256
005f28b334a8f0bc0b611a616e6558127d21dfec43a163ed4536c2bb46477ef9
-
SHA512
756b28a6787dc2de0d0372901982d4c384a02cf5517aa944ed2cbb2cebd23c172200f9220faf725b089ea97c8f81c878cd7e602a73b8721c1f89114ebe03549f
-
SSDEEP
768:h2zZiOKJ5yorr997+3YWSWMxahF438mpr8Fp9lvCRdi5NEjS+C7S4jFh0z1E6yfH:oi3yg2MxMMUflsdi54Em0Iy6yP4Nm36s
Malware Config
Signatures
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1716 sc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2260 powershell.exe 2764 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2260 powershell.exe Token: SeDebugPrivilege 2764 powershell.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 752 wrote to memory of 1716 752 cmd.exe 29 PID 752 wrote to memory of 1716 752 cmd.exe 29 PID 752 wrote to memory of 1716 752 cmd.exe 29 PID 752 wrote to memory of 2064 752 cmd.exe 30 PID 752 wrote to memory of 2064 752 cmd.exe 30 PID 752 wrote to memory of 2064 752 cmd.exe 30 PID 752 wrote to memory of 2124 752 cmd.exe 31 PID 752 wrote to memory of 2124 752 cmd.exe 31 PID 752 wrote to memory of 2124 752 cmd.exe 31 PID 752 wrote to memory of 2348 752 cmd.exe 32 PID 752 wrote to memory of 2348 752 cmd.exe 32 PID 752 wrote to memory of 2348 752 cmd.exe 32 PID 752 wrote to memory of 2260 752 cmd.exe 33 PID 752 wrote to memory of 2260 752 cmd.exe 33 PID 752 wrote to memory of 2260 752 cmd.exe 33 PID 752 wrote to memory of 2764 752 cmd.exe 34 PID 752 wrote to memory of 2764 752 cmd.exe 34 PID 752 wrote to memory of 2764 752 cmd.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Activators\HWID_Activation.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\System32\sc.exesc query Null2⤵
- Launches sc.exe
PID:1716
-
-
C:\Windows\System32\find.exefind /i "RUNNING"2⤵PID:2064
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "HWID_Activation.cmd"2⤵PID:2124
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver2⤵PID:2348
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe write-host -back '"Red"' -fore '"white"' '"==== ERROR ===="'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2260
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe write-host -back '"Black"' -fore '"Yellow"' '"Press any key to Exit..."'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5d340f3b2c08a61a38be92d906a1f4fd3
SHA10709279754099f93cde78ee68628e9faad294c03
SHA256316ef677c433f4db5920e8166526189513755e17aeac29006033ba48e1576a1e
SHA512059ba31496feb31f8271d5e2e7032ea283c36470c386857a2d98130e6ac835108b8aab05928fc1b7f8982d9605f81a080d602f5705a325c4466eeabbeac68628
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WHYXCIW05P0TDA9R9AT1.temp
Filesize7KB
MD5d340f3b2c08a61a38be92d906a1f4fd3
SHA10709279754099f93cde78ee68628e9faad294c03
SHA256316ef677c433f4db5920e8166526189513755e17aeac29006033ba48e1576a1e
SHA512059ba31496feb31f8271d5e2e7032ea283c36470c386857a2d98130e6ac835108b8aab05928fc1b7f8982d9605f81a080d602f5705a325c4466eeabbeac68628